Sample evidence pack
What you get at the end of a Fix Sprint.
This is the evidence pack from a rehearsal sprint we ran on OWASP NodeGoat, a deliberately vulnerable Node.js app, on 2026-10-14. Yours looks the same, with your repository's findings.
16
findings in scope
15
fixed: 6 by Railo, 9 by hand
1
explained, not changed
5
pull requests, all merged
Every finding
One row per finding in scope.
Each row says what was found, where, what happened to it, who fixed it, how the fix was checked, and the pull request it was merged in. The sprint ran in a private copy, so pull requests are shown by number.
| ID | Weakness | Location | Outcome | Fixed by | Check | Pull request | Merged |
|---|---|---|---|---|---|---|---|
| F-001 | Code injection CWE-94 | app/routes/contributions.js:32 | Fixed | By hand | Finding gone, nothing new | #4 | 2026-10-14 |
| F-002 | Code injection CWE-94 | app/routes/contributions.js:33 | Fixed | By hand | Finding gone, nothing new | #4 | 2026-10-14 |
| F-003 | Code injection CWE-94 | app/routes/contributions.js:34 | Fixed | By hand | Finding gone, nothing new | #4 | 2026-10-14 |
| F-004 | Open redirect CWE-601 | app/routes/index.js:72 | Fixed | Railo | Finding gone, nothing new | #1 | 2026-10-14 |
| F-005 | Insecure randomness CWE-330 | app/routes/session.js:16 | Fixed | Railo | Finding gone, nothing new | #2 | 2026-10-14 |
| F-006 | Insecure randomness CWE-330 | app/routes/session.js:17 | Fixed | Railo | Finding gone, nothing new | #2 | 2026-10-14 |
| F-007 | Hardcoded secret CWE-798 | artifacts/cert/server.key:1 | Explained, not changed | ||||
| F-008 | Hardcoded secret CWE-798 | artifacts/db-reset.js:18 | Fixed | By hand | Finding gone, nothing new | #5 | 2026-10-14 |
| F-009 | Hardcoded secret CWE-798 | artifacts/db-reset.js:19 | Fixed | By hand | Finding gone, nothing new | #5 | 2026-10-14 |
| F-010 | Hardcoded secret CWE-798 | artifacts/db-reset.js:27 | Fixed | By hand | Finding gone, nothing new | #5 | 2026-10-14 |
| F-011 | Hardcoded secret CWE-798 | artifacts/db-reset.js:28 | Fixed | By hand | Finding gone, nothing new | #5 | 2026-10-14 |
| F-012 | Hardcoded secret CWE-798 | artifacts/db-reset.js:35 | Fixed | By hand | Finding gone, nothing new | #5 | 2026-10-14 |
| F-013 | Hardcoded secret CWE-798 | artifacts/db-reset.js:36 | Fixed | By hand | Finding gone, nothing new | #5 | 2026-10-14 |
| F-014 | Hardcoded secret CWE-798 | config/env/all.js:8 | Fixed | Railo | Finding gone, nothing new | #3 | 2026-10-14 |
| F-015 | Hardcoded secret CWE-798 | config/env/development.js:6 | Fixed | Railo | Finding gone, nothing new | #3 | 2026-10-14 |
| F-016 | Hardcoded secret CWE-798 | config/env/test.js:6 | Fixed | Railo | Finding gone, nothing new | #3 | 2026-10-14 |
Explained, not changed
F-007 · artifacts/cert/server.key
A TLS private key is committed. Deleting the file does not help: it stays in git history and must be treated as exposed. Recommended: create a new key and certificate, keep them outside the repository (a deployment secret or a mounted file whose path server.js reads from the environment), remove artifacts/cert/server.key, and rewrite history if the repository is or was ever public.
How each fix was checked
- Every change, written by Railo or by hand, was rescanned with Railo's rules: the finding had to be gone and no new finding could appear.
- Every change was a pull request, reviewed and merged by the repository's owner. Nothing was pushed to an existing branch.
- A final scan of the merged code found only F-007, the committed TLS key, which is explained rather than changed.
The pack records the work. It is not a certification, and it says nothing about code outside the findings in scope.
Want this for your repository?
Send us your findings. Fixed price, one week, NDA first.